Malicious PDF — malware analysis report

Static analysis result for SHA-256 a939bfca523f74f0…

MALICIOUS

PDF

316.2 KB Created: 2021-03-27 14:54:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 13bd6edf4cb01579c247364196b168d3 SHA-1: 56c84d19ffefe585b611f76f6aceee845a18776c SHA-256: a939bfca523f74f045e9daf65dd4a30e9c95c03f3972e1615d3c9594830dc76b
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9536

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=manchester+journal+of+international+economic+law+impact+factor PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4489713/normal_600ae493935b6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4411918/normal_5fcd41de8c22e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4451755/normal_600656c8bdfc7.pdfIn PDF document text
    • https://betoxugibujimiv.weebly.com/uploads/1/3/1/0/131071043/b183043381fe.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4460954/normal_5fdf9e2653e49.pdfIn PDF document text
    • http://kmikaerfs.ru/propagacin_de_plantas_hartmann_y_ke76s0h.pdfIn PDF document text
    • http://arendagg.xyz/zutopadii6d3b.pdfIn PDF document text
    • https://direwuberegenis.weebly.com/uploads/1/3/4/3/134361890/2270565.pdfIn PDF document text
    • http://yogist.fun/lidawusamaronidarotajurnjxz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/94d57345-263f-4044-8478-27d9eeb73c84/can_i_learn_russian_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/912d58a5-ecbe-4120-a33e-95acdf0e47cb/89865846070.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/40b5ff73-18ed-49cb-a044-da9b4a3513dc/petsafe_automatic_feeder_reset.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/594c9bd2-3331-4f2a-967e-ea4e2e9f6816/what_is_the_main_theme_of_macbeth_act_1.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4227a039-f0a9-4bf0-b760-05c6f0945fbf/zapik.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1fc17b1b-df93-44e4-9ac7-1151900fb6a3/is_there_a_demand_for_technical_writers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ccdf55f-4680-4c45-8412-8cbfe5755ff4/vopitatem.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_011_off0004c27f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4C27F 18504 bytes
SHA-256: 415e9d19d69843b9c5d105f250ca833bc24b3e30d2686db8e46316acfa149149
font_00_sfnt_off00045e7d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x45E7D 3984 bytes
SHA-256: d39d63b3a6dc07c862b8595bac7c23f1b173be5a4bbfbcacb86be6d27b947059
font_01_sfnt_off00046c8a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x46C8A 5428 bytes
SHA-256: 4086bdd45b7705863bb73ae4b6559928b370880417c577981c09d190bf02dc91
font_02_sfnt_off00047ef9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x47EF9 25916 bytes
SHA-256: 973ff552071dc6397413484c3bc7af0de2c31bcec76b7dcd9c098a6651b7409a

Open this report in the interactive analyzer, or submit your own file for analysis.